summaryrefslogtreecommitdiff
path: root/src/lib/evas/canvas/evas_object_textblock.c
diff options
context:
space:
mode:
authorJean-Philippe Andre <jp.andre@samsung.com>2013-12-10 11:39:15 +0900
committerJean-Philippe Andre <jp.andre@samsung.com>2013-12-10 12:05:04 +0900
commit0cb048f9b681d43fe905d948e4f7b8e51bed9aa4 (patch)
tree7eeb8365a1d51dcd866db860fca3b4637cc0b679 /src/lib/evas/canvas/evas_object_textblock.c
parent5f2687b1f4a66ff4008e0949bdf0464d0e079523 (diff)
Evas textblock: Fix crash with empty markups values
Markup parsing will segv if a value string is empty, as in "<style=>". Sure, this is invalid, but hey, it could definitely be used from an app or even by a user writing his own markups :) The internal doc says this function expects an item to be of the form "key=val" but there are no checks beyond the presence of "=" in the string before calling it.
Diffstat (limited to '')
-rw-r--r--src/lib/evas/canvas/evas_object_textblock.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/src/lib/evas/canvas/evas_object_textblock.c b/src/lib/evas/canvas/evas_object_textblock.c
index 41cd76404e..f1c30184cd 100644
--- a/src/lib/evas/canvas/evas_object_textblock.c
+++ b/src/lib/evas/canvas/evas_object_textblock.c
@@ -2362,6 +2362,7 @@ _format_param_parse(const char *item, const char **key, Eina_Tmpstr **val)
2362 else len = strlen(start); 2362 else len = strlen(start);
2363 2363
2364 tmp = (char*) eina_tmpstr_add_length(start, len); 2364 tmp = (char*) eina_tmpstr_add_length(start, len);
2365 if (!tmp) goto end;
2365 2366
2366 for (d = tmp, s = tmp; *s; s++) 2367 for (d = tmp, s = tmp; *s; s++)
2367 { 2368 {
@@ -2373,6 +2374,7 @@ _format_param_parse(const char *item, const char **key, Eina_Tmpstr **val)
2373 } 2374 }
2374 *d = '\0'; 2375 *d = '\0';
2375 2376
2377end:
2376 *val = tmp; 2378 *val = tmp;
2377} 2379}
2378 2380
@@ -2450,7 +2452,7 @@ _format_fill(Evas_Object *eo_obj, Evas_Object_Textblock_Format *fmt, const char
2450 Eina_Tmpstr *val = NULL; 2452 Eina_Tmpstr *val = NULL;
2451 2453
2452 _format_param_parse(item, &key, &val); 2454 _format_param_parse(item, &key, &val);
2453 _format_command(eo_obj, fmt, key, val); 2455 if ((key) && (val)) _format_command(eo_obj, fmt, key, val);
2454 eina_stringshare_del(key); 2456 eina_stringshare_del(key);
2455 eina_tmpstr_del(val); 2457 eina_tmpstr_del(val);
2456 } 2458 }